AI makes up wine facts. So we gave it real data.

Ask any AI assistant how many points a particular Bordeaux wine scored in the 2024 vintage. You will get an answer. It will sound confident, it will have the right shape — and it will be invented. Not because the model is stupid, but because those numbers are nowhere on the open web. En primeur notes are written in April, at the barrel, in Bordeaux; whoever has them keeps them behind a subscription.

This is part two of the series Building bordeaux.guru. In part one we built the data layer: living maps of fifteen appellations, a climate database from ERA5 and a vintage radar that updates itself every week. This part is about what you do with a layer like that — how you open it so AI can take the data itself, without it slipping out of your hands.

Two interfaces, one data layer

One decision holds up everything else: the data gets exactly one gate. Not two implementations, not "this one for the website and that one for the API". One process, one set of tools, one set of rules about who may see what.

Two consumers sit on top of that gate:

• An MCP server at mcp.bordeaux.guru — for other people's AI agents. Connect it to Claude, to Claude Code, or to anything that speaks the Model Context Protocol, and your assistant can suddenly answer from our archive.
• Ask the Guru — our own assistant on the site, for signed-in visitors. It uses the very same tools, it just sits down at them from the inside.

It looks like a needless extra layer. It is not: this is exactly where it is decided who sees what, and because it is the only such place, it cannot be dodged by picking a different door.

You can see it is the same data layer right there: 95 points, tasted 7 April 2025, "a big surprise of the vintage". That is not text a model made up. It is a note from the database, only retold.

What is actually in the data

For wine people this is the more interesting half. Four kinds of data sit in the database, and each came about differently:

• First-hand tasting notes — 145 wines from 106 châteaux across fifteen appellations, en primeur 2024 and 2025. Written on site, in both Czech and English, with score, structure, blend, alcohol, yield and ageing potential. No ratings borrowed from anywhere else.
• Daily appellation climate — nine variables (temperatures, rainfall, wind, humidity, sunshine, evapotranspiration, radiation) for every appellation and every day of the growing season, from the ERA5 reanalysis. Plus soil moisture at two depths.
• Phenology — budbreak, flowering, veraison and harvest as reported by the estates themselves in their official material. This is château data, not our estimate, and the server says so with every answer.
• Terroir and parcels — dominant soils, relief from a real elevation model, gravel terraces after the geological survey, over 1,800 named plots from the French cadastre, and grape varieties parcel by parcel, digitised from château brochures.

This is what the answer looks like when an agent asks for a climate comparison — four appellations, three seasons, none of it estimated:

And the 2026 season is still running — the figures stand at 23 August, 140 days instead of a full 214. Even so it already has more hot days than the two previous seasons combined, on roughly a quarter of the rain that fell in 2024. That is exactly the kind of connection nobody can google about a wine.

That last one is also the hardest. Parcel-level varieties are not public anywhere. The French CVI register, which holds them, is a fiscal secret. The only route is digitising the maps an estate publishes itself — by hand, château by château.

How to connect it

The server is remote, so there is nothing to install. You need a single address: https://mcp.bordeaux.guru/mcp.

• Claude (desktop or web): Settings → Connectors → Add custom connector, paste the address, confirm.
• Claude Code: one command in the terminal — claude mcp add --transport http bordeaux-guru https://mcp.bordeaux.guru/mcp
• Anything else that speaks remote MCP over streamable HTTP: the address in a config file is enough.

Then you ask in plain language — "how did the 2026 season in Pauillac compare with 2024?", "which varieties does Gazin grow on which parcels?" — and the assistant picks from eleven tools by itself. You never need to know they exist.

What you get for free, and what you do not

I wanted to be tediously specific here, because "free tier" can mean almost anything in practice.

With no key and no account you get every score, profiles of châteaux, appellations and vintages, Pauillac climate for the latest season, terroir, and samples of named plots and parcel varieties. Twenty calls a day per address, at most five a minute. For tasting notes you get the score and the opening line — the full text is a membership matter.

If you want to read a full note for free, there is another route: Ask the Guru on the site gives every signed-in visitor one sample note a day from a curated set of eight wines. Registration is free and takes no card.

Gating belongs in the data, not in the prompt

This is the architectural decision I cared about most, and it is worth explaining, because it can easily be done badly.

The tempting route is to write into the system prompt: "only give full notes to members". It works. It looks finished. And it is worthless, because a prompt is just text, and text can be talked around. Sooner or later somebody finds the right phrasing and the model happily hands over what it should not.

So the gating is not in the prompt at all. It sits one floor down, in the data layer: the tool itself will not return a full note to anyone who is not entitled to it, no matter what the model asks. The model gets a teaser because nothing else exists. It cannot leak what it never received.

The same logic covers things that must never leave at all — audio transcripts from tastings, wholesale prices, verbatim brochure text. No tool, no route, no exceptions.

The registry: we are not alone, but we are different

Since 23 August 2026 the server is listed in the official MCP Registry as guru.bordeaux/en-primeur. The namespace is the domain reversed — that is what the registry requires, and ownership is proven by a DNS record, so nobody else can register a server under our name.

I expected to be the first wine server in the registry. We are not. When I actually checked, I found five: a wine catalogue, a home-cellar manager with a hundred thousand wines, a directory of thirty-two thousand wineries for visitors, a guide to no- and low-alcohol drinks, and a concierge for one German estate.

The difference matters more than being first, though: all of them aggregate, we measure and taste. A catalogue will tell you Pontet-Canet is Pauillac. None of them will tell you what the 2024 vintage scored, when that estate picked, how much rain fell between flowering and veraison, or which variety grows on which parcel. That data is not borrowed — somebody either measured it or drank it.

Four things it taught me

• Signing out has to sign out of everything. After the first deployment I tested the obvious: asked a question, signed out, asked again. The answer came anyway. The session had been deleted correctly — but the assistant has its own short-lived token, and that token survived. The lesson: every extra path to identity you add must also be wired into logout. Otherwise you have built a back door without noticing.
• Check marketing copy against the code, not against the spec. I wrote on the site that without a key you get full notes from the eight sample wines. It was in the spec. Then I called the live server for a wine that is in those eight — and got a teaser. The sample note is tied to a signed-in user, not to an anonymous connection. The spec did not draw that line; the code did. The code is always right.
• An address someone already occupies is a quiet trap. I wanted the page about the server at /mcp/. But that is where the application physically lives in production, so the web server would answer and my page would never appear. Fixed by renaming it to /mcp-server/ — but had it not been caught up front, that is hours of hunting.
• Read the limits before you send. The first attempt to publish to the registry failed with a 422: a server description may be a hundred characters and I had written nearly three hundred. Fixing it took a minute; writing a script that now checks the lengths beforehand took half an hour. That half hour pays for itself at every future update.

What is next

The nearest thing is a personal key for Cellar members — a connection that sees everything, with five hundred calls a day. Then streaming answers, so the assistant writes as it goes instead of staying silent and then producing a whole paragraph at once.

But the more interesting question is a different one. Once your data is available to AI agents, the website stops being the only place people meet you. Somebody asks their assistant about the 2025 vintage in Saint-Julien and the answer comes from us — they just see it in an entirely different window. That is why every answer from the server carries attribution and a link to the source page, in the language you asked in.

Whether it leads anywhere, we will know in a few months. So far it is the cheapest distribution channel I have ever built: one JSON file, one DNS record, and data nobody else has.

The MCP server runs at mcp.bordeaux.guru, connection instructions are at bordeaux.guru/mcp-server, the dataset catalogue at bordeaux.guru/data. Built on .NET 10, the official C# SDK for MCP and Claude. Have your own experience opening data to AI agents? Message me on LinkedIn.